﻿[int]$mitigationCode = 0

Write-Host Starting POODLE hardening 
Write-Host

Write-Host Checking Internet Options for correct settings...

if (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings' | Where-Object {$_.SecureProtocols -eq 2688})
    {
        Write-Host Internet Options settings are correct!
    }
else 
    {
        Write-Host Internet Options settings are incorrect applying correct key...
        New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings' -Name SecureProtocols -Type dword -Value 2688
    }

Write-Host
Write-Host Checking to see if the local OS has SSL 3.0 registered for keying...

if (Test-Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0')
    {
        Write-Host SSL 3.0 registry exists!
        Write-Host
        Write-Host Checking on key sub registries and keys
            
            if(Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" | Where-Object {$_.DisabledByDefault -eq 1})
                {
                    Write-Host Client key is setup correctly 
                }
            else 
                {
                    Write-Host Client key is not setup to mitigate POODLE, applying correct key...
                    New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" -PropertyType DWORD -Name DisabledByDefault -Value 1
                }

            Write-Host Checking on Server keying...

            if (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server' | Where-Object {$_.Enabled -eq 0})
                {
                    Write-Host Server key is setup correctly 
                }
            else 
                {
                    Write-Host Server key is not setup to mitigate POODLE, applying correct key...
                    New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ssl 3.0\Server" -PropertyType DWORD -Name Enabled -Value 0
                }          
    }
else 
    {
      Write-Host Local OS doesnt have an SSL 3.0 registry 
      Write-Host
      Write-Host Creating Registry and sub registries
      New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0" -Force #-WhatIf
      New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" -Force #-WhatIf
      New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" -Force #-WhatIf
      Write-Host
      Write-Host Done!
      Write-Host Creating Client and Server keys...
      New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" -PropertyType DWORD -Name DisabledByDefault -Value 1
      New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ssl 3.0\Server" -PropertyType DWORD -Name Enabled -Value 0
      Write-Host
      Write-Host Done!
    }

Write-Host Verifying Mitigation...

if (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings' | Where-Object {$_.SecureProtocols -eq 2688})
    {
        Write-Host Internet Options settings are good!
        $mitigationCode++
    }
else 
    {
        Write-Host Internet Options settings are not set correctly. Please check run this program as an administrative user with regedit.exe read/write.
    }

if (Test-Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0')
    {
        Write-Host SSL 3.0 registry is good!
        $mitigationCode++
    }
else 
    {
        Write-Host SSL 3.0 registry is not set correctly. Please check run this program as an administrative user with regedit.exe read/write.
    }

 if(Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" | Where-Object {$_.DisabledByDefault -eq 1})
    {
        Write-Host Client keying is good!
        $mitigationCode++
    }
else 
    {
        Write-Host Client keying is not set correctly. Please check run this program as an administrative user with regedit.exe read/write.
    }

if (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server' | Where-Object {$_.Enabled -eq 0})
     {
        Write-Host Server keying is good!
        $mitigationCode++
     }
else 
    {
        Write-Host Server keying is not set correctly. Please check run this program as an administrative user with regedit.exe read/write.
    }

if ($mitigationCode -eq 4)
    {
        Write-Host POODLE has successfully been mitigated on this machine!
  
    }
else
    {
        Write-Host This machine has NOT been mitigated by POODLE! Please check this console log for more details
    }

Write-Host Developed by: Andrew Lass
Write-Host Black Dog Systems
Write-Host www.bdsys.net
Write-Host Made in Everett Washington